Buggy code:
public class SecurityExtension implements Extension { public static final ServiceName JBOSS_SECURITY = JBOSS . append ( "security" ) ; public static final String SUBSYSTEM_NAME = "security" ; static final PathElement PATH_SUBSYSTEM = PathElement . pathElement ( SUBSYSTEM , SecurityExtension . SUBSYSTEM_NAME ) ; private static final String RESOURCE_NAME = ( SecurityExtension . class . getPackage ( ) . getName ( ) ) + ".LocalDescriptions" ; private static final int MANAGEMENT_API_MAJOR_VERSION = 1 ; private static final int MANAGEMENT_API_MINOR_VERSION = 2 ; private static final int MANAGEMENT_API_MICRO_VERSION = 1 ; private static final SecuritySubsystemParser PARSER = SecuritySubsystemParser . getInstance ( ) ; static final PathElement ACL_PATH = PathElement . pathElement ( ACL , CLASSIC ) ; static final PathElement PATH_JASPI_AUTH = PathElement . pathElement ( AUTHENTICATION , JASPI ) ; static final PathElement PATH_CLASSIC_AUTHENTICATION = PathElement . pathElement ( AUTHENTICATION , CLASSIC ) ; static final PathElement SECURITY_DOMAIN_PATH = PathElement . pathElement ( SECURITY_DOMAIN ) ; static final PathElement PATH_AUTHORIZATION_CLASSIC = PathElement . pathElement ( AUTHORIZATION , CLASSIC ) ; static final PathElement PATH_MAPPING_CLASSIC = PathElement . pathElement ( MAPPING , CLASSIC ) ; static final PathElement PATH_AUDIT_CLASSIC = PathElement . pathElement ( AUDIT , CLASSIC ) ; static final PathElement PATH_LOGIN_MODULE_STACK = PathElement . pathElement ( LOGIN_MODULE_STACK ) ; static final PathElement VAULT_PATH = PathElement . pathElement ( VAULT , CLASSIC ) ; static final PathElement JSSE_PATH = PathElement . pathElement ( JSSE , CLASSIC ) ; private static final PathAddressTransformer CURRENT_PATH_TRANSFORMER = new PathAddressTransformer ( ) { @ Override public PathAddress transform ( PathElement current , Builder builder ) { } } ; static StandardResourceDescriptionResolver getResourceDescriptionResolver ( final String keyPrefix ) { } static StandardResourceDescriptionResolver getResourceDescriptionResolver ( final String ... keyPrefix ) { } @ Override public void initialize ( ExtensionContext context ) { } @ Override public void initializeParsers ( ExtensionParsingContext context ) { } private void registerTransformers ( SubsystemRegistration subsystemRegistration ) { } private void registerTransformers_1_1_0 ( SubsystemRegistration subsystemRegistration ) { } private void registerTransformers_1_2_0 ( SubsystemRegistration subsystemRegistration ) { } private ResourceTransformationDescriptionBuilder registerModuleTransformer ( ResourceTransformationDescriptionBuilder parent , final PathElement childPath , SecurityExtension . ModulesToAttributeTransformer transformer ) { } private ResourceTransformationDescriptionBuilder registerModuleTransformer ( ResourceTransformationDescriptionBuilder parent , final PathElement childPath , SecurityExtension . AttributeToModulesTransformer transformer ) { } private static class ModulesToAttributeTransformer implements CombinedTransformer { protected final String resourceName ; protected final String oldName ; private final Map < PathAddress , Boolean > addOps = Collections . synchronizedMap ( new HashMap < PathAddress , Boolean > ( ) ) ; private ModulesToAttributeTransformer ( String resourceName , String oldName ) { } String getResourceName ( ) { } private boolean isAddOpAdded ( PathAddress address ) { } @ Override public void transformResource ( ResourceTransformationContext context , PathAddress address , Resource resource ) throws OperationFailedException { } public TransformedOperation transformOperation ( TransformationContext context , PathAddress address , ModelNode operation ) throws OperationFailedException { ModelNode model = new ModelNode ( ) ; transformModulesToAttributes ( address , resourceName , oldName , context , model ) ; ModelNode modules = model . get ( oldName ) ; int len = modules . asList ( ) . size ( ) ; boolean addOpAdded = isAddOpAdded ( address ) ; if ( len == 0 ) { operation = new ModelNode ( ) ; operation . get ( OP ) . set ( REMOVE ) ; } else if ( ! addOpAdded ) { operation = model . clone ( ) ; operation . get ( OP ) . set ( ADD ) ; } else { operation . clear ( ) ; operation . get ( OP ) . set ( WRITE_ATTRIBUTE_OPERATION ) ; operation . get ( NAME ) . set ( oldName ) ; operation . get ( VALUE ) . set ( modules ) ; } operation . get ( OP_ADDR ) . set ( address . toModelNode ( ) ) ; return new TransformedOperation ( operation , OperationResultTransformer . ORIGINAL_RESULT ) ; } private void transformModulesToAttributes ( final PathAddress address , final String newName , final String oldName , final TransformationContext context , final ModelNode model ) { } } private static class AttributeToModulesTransformer implements OperationTransformer { private final String attributeName ; private AttributeToModulesTransformer ( String attributeName ) { } @ Override public TransformedOperation transformOperation ( TransformationContext context , PathAddress address , ModelNode operation ) throws OperationFailedException { final ModelNode transformedOp ; if ( ! ( operation . has ( attributeName ) ) ) { transformedOp = operation ; } else if ( ! ( operation . hasDefined ( attributeName ) ) ) { transformedOp = operation . clone ( ) ; transformedOp . remove ( attributeName ) ; } else { PathAddress pa = PathAddress . pathAddress ( operation . get ( OP_ADDR ) ) ; <START_BUG> transformedOp = Util . createEmptyOperation ( COMPOSITE , pa ) ; <END_BUG> ModelNode steps = transformedOp . get ( STEPS ) ; ModelNode clone = operation . clone ( ) ; clone . remove ( attributeName ) ; steps . add ( clone ) ; ModelNode writeOp = Util . createEmptyOperation ( WRITE_ATTRIBUTE_OPERATION , pa ) ; writeOp . get ( NAME ) . set ( attributeName ) ; writeOp . get ( VALUE ) . set ( operation . get ( attributeName ) ) ; steps . add ( writeOp ) ; } return new TransformedOperation ( transformedOp , OperationResultTransformer . ORIGINAL_RESULT ) ; } } }

Fix:
transformedOp = Util . createEmptyOperation ( COMPOSITE , null ) ;